Code for the current version of Apache (2.4)
Require ip xx.yy.zz.kk
Require all denied
Is it possible to have access from other IP address?
No, unless the source IP gets spoofed by the attacker
Or maybe someone can make fake requests signed as from xxx.xxx.xxx.xxx client?
Unlikely if your "public hosting server" is on a hardened network that will try to prevent blatant attacks
References:
In particular, while a very single packet can be spoofed at no cost, you should both know that 1) it won't likely survive your ISP's first hop, and that 2) it takes fully stealing an IP address class in order to fully establish and maintain a TCP session to a firewalled box. This is something you can't realistically do home, as you need large control over network and BGP routes. Network providers are aware of this threat and are working on multiple solutions, like authentication and the BGPSec protocol, to mitigate.
Conclusion: as for your firewall, it will work as expected and you can rest assured. Further comment: you may also like defense-in-depth and I recommend you to add additional security measures, e.g. strong authentication at application level